Re: Rust pkgs with eMudhra's bad certs in webpki-roots

[pin <voidpin%protonmail.com@localhost>]

On Thursday, October 22nd, 2026 at 7:33 AM, Benny Siegert <bsiegert%netbsd.org@localhost> wrote:

> 
> 
> On Wed, 21 Oct 2026, pin wrote:
> 
> > But maybe there's something I'm not aware of.
> 
> The Go build system has the "replace" directive, which is meant for things
> like this.
> 
> AIUI, In cargo, you can put [path.crates-io] sections into Cargo.toml,
> maybe that would help?


Yes, adding a [patch.crates.io] section to Cargo.toml is a way.

But perhaps, I should have been more clear because, doing this still requires manual handling.
What I should have said is, I don't know a way of doing this in an automated way.

Actually, a big chuck of projects don't pin down crates down to "y" in 1.x.y
Usually this is only done when a newer version causes breakage.

In other words, you could run 'cargo update' and have a new Cargo.lock file with a new set of crate dependencies.
The risk here is there's no way to ensure the result will still build with the specified rust version.

Just for clarity ...
> We have dozens of Rust packages that pull in the webpki-roots or webpki-root-certs

Here's the complete list (no wip packages included):
/audio/librespot
/audio/ncspot
/audio/termusic
/chat/gurk
/chat/iamb
/devel/git-cliff
/devel/cargo-upgrades
/devel/cargo-about
/devel/cargo-release
/devel/cargo-edit
/devel/cargo-flamegraph
/devel/cargo-licenses
/devel/cargo-nextest
/devel/codeberg-cli
/devel/feluda
/devel/mise
/devel/gitpane
/devel/py-maturin
/devel/sem
/devel/carwash
/devel/py-uv
/devel/sccache
/emulators/jgenesis
/finance/rex
/games/chess-tui
/graphics/matugen
/graphics/oculante
/lang/gleam
/mail/himalaya
/mail/dmarc-report-viewer
/misc/katbin-cli
/misc/katbin-cli
/misc/rozi
/misc/asciinema-agg
/misc/weatherman #not affected already uses webpki-root-certs-1.0.10.crate
/multimedia/moviebox-tui
/net/bandsnatch
/net/arti/distinfo:BLAKE2s (webpki-root-certs-1.0.9.crate) = c0ddf22eebb506dd898ead38b077e26df58c5541a860269a9c9ce54c946d15b9
/net/nostui
/net/piratebay
/net/routinator
/net/yaydl
/net/sniffnet
/net/termscp
/net/tlrc
/net/slumber
/net/rustdesk-server
/net/ttl
/net/xfr
/news/lobtui
/news/bulletty
/news/eilmeldung
/news/tuifeed
/news/usenet_reborn
/pkgtools/mktool
/security/cargo-audit
/security/defguard
/security/cargo-deny
/security/flawz
/security/vaultwarden
/security/sslx
/shells/nushell
/sysutils/tealdeer
/sysutils/lla
/sysutils/mirador
/sysutils/yazi
/sysutils/xtop
/textproc/angle-grinder
/textproc/inlyne
/textproc/harper
/textproc/tabiew
/textproc/television
/textproc/rumdl
/textproc/treemd
/www/xh
/www/py-selenium
/www/zola
/www/crates-io-cli
/www/hackernews-tui
/www/monolith
/www/py-zensical
/www/wikid